CVE-2026-98153 PUBLISHED

nvme: fix racy access to FDP placement id array

Assigner: Linux
Reserved: 25.09.2026 Published: 25.09.2026 Updated: 25.09.2026

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix racy access to FDP placement id array

nvme_query_fdp_info() is called per-path and therefore prone to races.

It populates head->nr_plids/head->plids for fdp registration. But nothing protects that pair from concurrent access - two paths scanning the same namespace can race to populate it.

Avoid the race by moving this initialization work to nvme_alloc_ns_head() which is called once per shared namespace.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 30b5f20bb2ddab013035399e5c7e6577da49320a to e0a23e3c8c4c3ce11529fa70d2292b4e56d143ba (excl.)
  • affected from 30b5f20bb2ddab013035399e5c7e6577da49320a to 56e1c6bbe4bb084d7ecf61698afdf70be23dd35f (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.16 is affected
  • unaffected from 0 to 6.16 (excl.)
  • unaffected from 7.2.7 to 7.2.* (incl.)
  • unaffected from 7.3-rc2 to * (incl.)

References